Test environment

Transactions created for a sandbox organization are test transactions and do not affect production accounting.

Sandbox and production use the same API base URL and request contract. The organization associated with the API key determines the environment, so keep credentials in separate secret stores and never select an environment with a client-supplied request field.

bKash test payer

Use unique merchant_id values in automated tests. H2H idempotency is scoped to the organization, so a test that reuses an ID with different immutable fields correctly receives 409.

Recommended contract tests

Test at least:

1. a redirect checkout can be created and reaches a terminal status;
2. identical H2H create requests return the same deposit;
3. body changes invalidate the signature;
4. timestamps older than five minutes are rejected;
5. both display_instructions and redirect next actions are handled;
6. duplicate payment transaction IDs are idempotent;
7. a withdrawal can be created and inspected;
8. webhook signatures are verified against raw request bytes;
9. webhook consumers ignore already-processed event/message IDs;
10. your client preserves and handles the documented API error envelope.

Use deterministic merchant_id prefixes per test run, record OmniPay resource IDs in test output, and include the response X-Request-Id when a contract test fails. Do not assert that asynchronous transitions complete within an exact number of seconds.

Sandbox credentials can change independently of the API contract. Confirm their current availability with your OmniPay account contact before running a release test suite.